[GHSA-cx25-xg7c-xfm5] Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability #6413
Conversation
github-actions
bot
changed the base branch from
main
to
ryanmurf/advisory-improvement-6413
There was a problem hiding this comment.
Pull Request Overview
This pull request updates the security advisory for CVE-2025-54656 to include an additional affected package entry. The advisory addresses an Improper Output Neutralization for Logs vulnerability in Apache Struts.
- Adds support for the legacy
struts:strutsgroupId (used in Struts 1.2.x) - Updates the modified timestamp
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "1.2.0" |
There was a problem hiding this comment.
The version range for struts:struts starts at '1.2.0', but other similar advisories (e.g., GHSA-5ggr-mpgw-3mgx, GHSA-7jw3-5q4w-89qg) consistently use '0' as the introduced version for this package. Unless there's a specific reason why versions before 1.2.0 are not affected, consider starting from '0' to maintain consistency with other advisories and ensure comprehensive coverage.
| "introduced": "1.2.0" | |
| "introduced": "0" |
Updates
Comments
struts 1.2.x has different groupId then 1.3.x